- name: Playbook to check
  hosts: all
  gather_facts: false
  tasks:
    - name: Check the status
      ansible.builtin.shell:
        cmd: |
          set -o pipefail
          mokutil --sb-state
        executable: /bin/bash
      register: out
      changed_when: "'SecureBoot enabled' not in out.stdout"